@swissjs/swite 0.3.5 → 0.4.1

package/dist/kernel/package-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-registry.d.ts","sourceRoot":"","sources":["../../src/kernel/package-registry.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,GAAG,CAAC;CAClB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAgB;IAEjC;;OAEG;IACG,aAAa,CACjB,aAAa,EAAE,MAAM,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,IAAI,CAAC;IAwChB;;OAEG;YACW,aAAa;IAmF3B;;OAEG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAIpD;;OAEG;IACH,cAAc,IAAI,WAAW,EAAE;IAI/B;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAW7B;;OAEG;IACH,eAAe,IAAI,MAAM;CAG1B;AAKD,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD"}
+{"version":3,"file":"package-registry.d.ts","sourceRoot":"","sources":["../../src/kernel/package-registry.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,GAAG,CAAC;CAClB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAgB;IAEjC;;OAEG;IACG,aAAa,CACjB,aAAa,EAAE,MAAM,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,IAAI,CAAC;IAwChB;;OAEG;YACW,aAAa;IAmF3B;;OAEG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAIpD;;OAEG;IACH,cAAc,IAAI,WAAW,EAAE;IAI/B;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAW7B;;OAEG;IACH,eAAe,IAAI,MAAM;CAG1B;AAKD,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/kernel/package-registry.js

@@ -157,3 +157,11 @@ export function getPackageRegistry() {
     }
     return registryInstance;
 }
+/**
+ * Reset the package registry singleton. For use in tests only.
+ * Call before creating a ModuleResolver to prevent the previous scan state
+ * from leaking between tests.
+ */
+export function resetPackageRegistry() {
+    registryInstance = null;
+}

package/dist/kernel/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/kernel/workspace.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgD5E"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/kernel/workspace.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8C5E"}

package/dist/kernel/workspace.js

@@ -10,29 +10,31 @@ import path from "node:path";
  * Updated: Now also checks for lib/ directory to ensure we find the correct SWS root
  */
 export async function findWorkspaceRoot(root) {
+    const debug = process.env["SWITE_DEBUG"] === "1";
     let current = root;
-    for (let i = 0; i < 10; i++) { // Increased from 5 to 10 to go higher up
+    for (let i = 0; i < 10; i++) {
         const workspaceFile = path.join(current, "pnpm-workspace.yaml");
         const packageJson = path.join(current, "package.json");
         const libDir = path.join(current, "lib");
         try {
             await fs.access(workspaceFile);
-            // Accept root if it has lib/ (SWS with lib/) or packages/ (SWS with packages/ at root)
             const packagesDir = path.join(current, "packages");
             try {
                 await fs.access(libDir);
-                console.log(`[workspace] Found workspace root with lib/: ${current}`);
+                if (debug)
+                    console.log(`[workspace] Found workspace root with lib/: ${current}`);
                 return current;
             }
             catch {
                 try {
                     await fs.access(packagesDir);
-                    console.log(`[workspace] Found workspace root with packages/: ${current}`);
+                    if (debug)
+                        console.log(`[workspace] Found workspace root with packages/: ${current}`);
                     return current;
                 }
                 catch {
-                    // Workspace file exists but no lib/ or packages/, continue searching up
-                    console.log(`[workspace] Found workspace file at ${current} but no lib/ or packages/, continuing search...`);
+                    if (debug)
+                        console.log(`[workspace] Found workspace file at ${current} but no lib/ or packages/, continuing search...`);
                 }
             }
         }
@@ -40,10 +42,10 @@ export async function findWorkspaceRoot(root) {
             try {
                 const pkgJson = JSON.parse(await fs.readFile(packageJson, "utf-8"));
                 if (pkgJson?.workspaces) {
-                    // Also check for lib/ when package.json has workspaces
                     try {
                         await fs.access(libDir);
-                        console.log(`[workspace] Found workspace root with lib/ (via package.json): ${current}`);
+                        if (debug)
+                            console.log(`[workspace] Found workspace root with lib/ (via package.json): ${current}`);
                         return current;
                     }
                     catch {
@@ -60,6 +62,7 @@ export async function findWorkspaceRoot(root) {
             break;
         current = parent;
     }
-    console.warn(`[workspace] No workspace root found starting from: ${root}`);
+    if (debug)
+        console.warn(`[workspace] No workspace root found starting from: ${root}`);
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swissjs/swite",
-  "version": "0.3.5",
+  "version": "0.4.1",
   "description": "SWITE - SWISS Development Server (Vite replacement)",
   "type": "module",
   "main": "dist/index.js",
@@ -8,9 +8,19 @@
   "bin": {
     "swite": "dist/cli.js"
   },
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "tsc -b --watch",
+    "clean": "rm -rf dist node_modules && rm -f tsconfig.tsbuildinfo",
+    "generate-import-map": "tsx src/internal/generate-import-map-cli.ts",
+    "test": "node --import tsx --test __tests__/import-rewriter-bug.test.ts",
+    "changeset": "changeset",
+    "release:version": "changeset version",
+    "release:publish": "changeset publish"
+  },
   "dependencies": {
-    "@swissjs/core": "0.1.11",
-    "@swissjs/compiler": "0.1.5",
+    "@swissjs/core": "0.2.0",
+    "@swissjs/compiler": "0.2.0",
     "@swissjs/plugin-file-router": "1.0.2",
     "chalk": "^5.3.0",
     "chokidar": "^3.5.3",
@@ -32,18 +42,20 @@
     "access": "public"
   },
   "license": "MIT",
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ],
+    "overrides": {
+      "path-to-regexp": "^0.1.13",
+      "picomatch": "^2.3.2",
+      "qs": ">=6.15.2",
+      "esbuild": ">=0.25.0",
+      "vite": ">=6.4.2"
+    }
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/kibologic/swite.git"
-  },
-  "scripts": {
-    "build": "tsc -b",
-    "dev": "tsc -b --watch",
-    "clean": "rm -rf dist node_modules && rm -f tsconfig.tsbuildinfo",
-    "generate-import-map": "tsx src/internal/generate-import-map-cli.ts",
-    "test": "node --import tsx --test __tests__/import-rewriter-bug.test.ts",
-    "changeset": "changeset",
-    "release:version": "changeset version",
-    "release:publish": "changeset publish"
   }
-}
+}

package/src/build-engine/builder.ts

@@ -56,9 +56,9 @@ export class SwiteBuilder {
       await this.copyPublicAssets();
 
       const duration = Date.now() - startTime;
-      console.log(chalk.green(`\n✅ Build completed in ${duration}ms\n`));
+      console.log(chalk.green(`\n[OK] Build completed in ${duration}ms\n`));
     } catch (error) {
-      console.error(chalk.red("\n❌ Build failed:"), error);
+      console.error(chalk.red("\n[FAIL] Build failed:"), error);
       throw error;
     } finally {
       await fs.rm(tempDir, { recursive: true, force: true });
@@ -66,13 +66,13 @@ export class SwiteBuilder {
   }
 
   private async cleanOutputDir(): Promise<void> {
-    console.log(chalk.blue("🧹 Cleaning output directory..."));
+    console.log(chalk.blue("[clean] Cleaning output directory..."));
     await fs.rm(this.config.outDir, { recursive: true, force: true });
     await fs.mkdir(this.config.outDir, { recursive: true });
   }
 
   private async compileSwissFiles(tempDir: string): Promise<void> {
-    console.log(chalk.blue("🔨 Compiling Swiss files..."));
+    console.log(chalk.blue("[compile] Compiling Swiss files..."));
     await fs.mkdir(tempDir, { recursive: true });
 
     const workspaceRoot = await this.findWorkspaceRoot(this.config.root);
@@ -90,7 +90,7 @@ export class SwiteBuilder {
     // Step 2: Discover and compile workspace dependencies
     const workspaceDeps = await this.discoverWorkspaceDependencies();
     for (const dep of workspaceDeps) {
-      console.log(chalk.blue(`📦 Compiling dependency: ${dep.name}`));
+      console.log(chalk.blue(`[bundle] Compiling dependency: ${dep.name}`));
       // Preserve workspace structure: libraries/skltn/src or packages/cart/src or modules/cart/src
       const depRelativeToWorkspace = workspaceRoot
         ? path.relative(workspaceRoot, dep.pkgDir)
@@ -269,7 +269,7 @@ export class SwiteBuilder {
                     pkgDir,
                   });
                   console.log(
-                    chalk.gray(`  📦 Found workspace dependency: ${depName}`),
+                    chalk.gray(`  [dep] Found workspace dependency: ${depName}`),
                   );
                   break;
                 }
@@ -315,7 +315,7 @@ export class SwiteBuilder {
                 });
                 console.log(
                   chalk.gray(
-                    `  📦 Discovered transitive dependency: ${pkgName}`,
+                    `  [dep] Discovered transitive dependency: ${pkgName}`,
                   ),
                 );
                 break;
@@ -325,14 +325,14 @@ export class SwiteBuilder {
         }
       }
     } catch (error) {
-      console.warn(chalk.yellow("⚠️  Could not discover dependencies:"), error);
+      console.warn(chalk.yellow("[warn] Could not discover dependencies:"), error);
     }
 
     return deps;
   }
 
   private async bundle(tempDir: string): Promise<void> {
-    console.log(chalk.blue("📦 Bundling with esbuild..."));
+    console.log(chalk.blue("[bundle] Bundling with esbuild..."));
 
     const workspaceRoot = await this.findWorkspaceRoot(this.config.root);
     const appRelativeToWorkspace = workspaceRoot

package/src/config/config.ts

@@ -37,11 +37,6 @@ export interface SwiteUserConfig {
    * Path is relative to the project root.
    */
   entry?: string;
-  /**
-   * Module aliases resolved during bare import resolution.
-   * e.g. { "@/": "src/" } maps @/ imports to the src/ directory.
-   */
-  aliases?: Record<string, string>;
   /**
    * Glob patterns to exclude from HMR watching in addition to the defaults
    * (node_modules, .git, dist). Useful for generated files or large assets.

package/src/dev-engine/handlers/base-handler.ts

@@ -6,8 +6,14 @@
 
 import type { Response } from "express";
 import { promises as fs } from "node:fs";
+import { UiCompiler } from "@swissjs/compiler";
+import chalk from "chalk";
 import { ModuleResolver } from "../../resolution/resolver.js";
 import { resolveFilePath } from "../../resolution/path/file-path-resolver.js";
+import { rewriteImports } from "../../resolution/rewriting/import-rewriter.js";
+import { inlineEnvReferences } from "../../config/env.js";
+import { compilationCache } from "../../internal/cache/compilation-cache.js";
+import { fixSwissLibPaths } from "../../resolution/path/path-fixup.js";
 import type { SwiteUserConfig } from "../../config/config.js";
 
 export interface HandlerContext {
@@ -29,12 +35,115 @@ export function setDevHeaders(res: Response): void {
   res.setHeader("Surrogate-Control", "no-store");
 }
 
+const BARE_IMPORT_RE = /(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/;
+
 /**
  * Base handler utilities
  */
 export class BaseHandler {
+  private compiler = new UiCompiler();
+
   constructor(protected context: HandlerContext) {}
 
+  /**
+   * Shared compile-and-serve pipeline used by UIHandler and UIXHandler.
+   * Compiles a .ui/.uix file, rewrites imports, applies path fixup, and sends the response.
+   */
+  protected async compileAndServe(
+    url: string,
+    filePath: string,
+    res: Response,
+    label: string,
+  ): Promise<void> {
+    const pathFixupEnabled = this.context.userConfig?.compilerPathFixup?.enabled !== false;
+    const pathFixupPatterns = this.context.userConfig?.compilerPathFixup?.patterns;
+    const applyPathFixup = (code: string) =>
+      pathFixupEnabled ? fixSwissLibPaths(code, pathFixupPatterns) : code;
+
+    // Cache hit
+    const cached = await compilationCache.get(filePath, (c) => this.getDependencies(c));
+    if (cached) {
+      const fixed = applyPathFixup(cached);
+      setDevHeaders(res);
+      res.setHeader("Content-Type", "application/javascript; charset=utf-8");
+      res.setHeader("Content-Length", Buffer.byteLength(fixed, "utf-8"));
+      res.end(fixed, "utf-8");
+      return;
+    }
+
+    // Cache miss — compile
+    const source = await fs.readFile(filePath, "utf-8");
+    let compiled = await this.compiler.compileAsync(source, filePath);
+
+    const esbuild = await import("esbuild");
+    const tsResult = await esbuild.transform(compiled, {
+      loader: "ts",
+      format: "esm",
+      target: "esnext",
+      sourcefile: filePath,
+    });
+    compiled = tsResult.code;
+
+    compiled = applyPathFixup(compiled);
+    compiled = inlineEnvReferences(compiled, this.context.env);
+
+    // Handle CSS imports:
+    // - Named/default imports (CSS modules): replace with const binding to empty object
+    //   so that apps using `import styles from "./x.module.css"` get {} instead of undefined.
+    // - Side-effect imports (import "./x.css"): strip silently — no runtime value needed.
+    // - Dynamic imports (import("./x.css")): return empty object.
+    const beforeCss = compiled;
+    // Named/default imports → const <binding> = {}
+    compiled = compiled.replace(
+      /^[^\S\r\n]*import\s+((?:\w+\s*,?\s*)?(?:\{[^}]*\}\s*,?\s*)?(?:\*\s+as\s+\w+\s*)?)\bfrom\s*['"][^'"]*\.css['"]\s*;?[^\S\r\n]*$/gm,
+      (_match, binding) => {
+        // Extract identifiers from the binding clause and emit const declarations
+        const ids: string[] = [];
+        const defaultMatch = binding.match(/^(\w+)(?:\s*,|\s*$)/);
+        if (defaultMatch) ids.push(defaultMatch[1]);
+        const nsMatch = binding.match(/\*\s+as\s+(\w+)/);
+        if (nsMatch) ids.push(nsMatch[1]);
+        const namedMatch = binding.match(/\{([^}]+)\}/);
+        if (namedMatch) {
+          namedMatch[1].split(",").forEach((s: string) => {
+            const alias = s.trim().split(/\s+as\s+/).pop()?.trim();
+            if (alias) ids.push(alias);
+          });
+        }
+        return ids.length ? ids.map((id) => `const ${id} = {};`).join(" ") : "";
+      },
+    );
+    // Side-effect imports → strip
+    compiled = compiled.replace(/^[^\S\r\n]*import\s*['"][^'"]*\.css['"]\s*;?[^\S\r\n]*$/gm, "");
+    // Dynamic imports → empty object
+    compiled = compiled.replace(/\bimport\s*\(\s*['"][^'"]*\.css['"]\s*\)/g, "({})");
+    if (beforeCss !== compiled) {
+      const _debug = process.env["SWITE_DEBUG"] === "1";
+      if (_debug) console.log(chalk.blue(`[${label}] Handled CSS imports from ${url}`));
+    }
+
+    if (BARE_IMPORT_RE.test(compiled)) {
+      console.warn(`[${label}] Compiled output contains bare imports: ${url}`);
+    }
+
+    const rewritten = await rewriteImports(compiled, filePath, this.context.resolver);
+    const finalCode = applyPathFixup(rewritten);
+
+    await compilationCache.set(filePath, compiled, finalCode, (c) => this.getDependencies(c));
+
+    if (BARE_IMPORT_RE.test(finalCode)) {
+      console.error(`[${label}] Bare imports still present after rewriting: ${url}`);
+      for (const m of Array.from(rewritten.matchAll(/(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/g)).slice(0, 3)) {
+        console.error(`[${label}] Unresolved import: ${m[1]}`);
+      }
+    }
+
+    setDevHeaders(res);
+    res.setHeader("Content-Type", "application/javascript; charset=utf-8");
+    res.setHeader("Content-Length", Buffer.byteLength(finalCode, "utf-8"));
+    res.end(finalCode, "utf-8");
+  }
+
   protected async resolveFilePath(url: string): Promise<string> {
     return resolveFilePath(url, this.context.root, this.context.workspaceRoot, this.context.userConfig);
   }

package/src/dev-engine/handlers/ui-handler.ts

@@ -6,21 +6,10 @@
 
 import type { Response } from "express";
 import { promises as fs } from "node:fs";
-import { UiCompiler } from "@swissjs/compiler";
 import chalk from "chalk";
-import { rewriteImports } from "../../resolution/rewriting/import-rewriter.js";
-import { inlineEnvReferences } from "../../config/env.js";
-import { compilationCache } from "../../internal/cache/compilation-cache.js";
-import { fixSwissLibPaths } from "../../resolution/path/path-fixup.js";
-import {
-  BaseHandler,
-  setDevHeaders,
-  type HandlerContext,
-} from "./base-handler.js";
+import { BaseHandler, setDevHeaders, type HandlerContext } from "./base-handler.js";
 
 export class UIHandler extends BaseHandler {
-  private compiler = new UiCompiler();
-
   constructor(context: HandlerContext) {
     super(context);
   }
@@ -36,75 +25,6 @@ export class UIHandler extends BaseHandler {
       throw new Error(`File not found: ${url} (resolved to: ${filePath})`);
     }
 
-    const pathFixupEnabled = this.context.userConfig?.compilerPathFixup?.enabled !== false;
-    const pathFixupPatterns = this.context.userConfig?.compilerPathFixup?.patterns;
-    const applyPathFixup = (code: string) =>
-      pathFixupEnabled ? fixSwissLibPaths(code, pathFixupPatterns) : code;
-
-    // Cache hit
-    const cached = await compilationCache.get(filePath, (compiled) => this.getDependencies(compiled));
-    if (cached) {
-      const fixed = applyPathFixup(cached);
-      setDevHeaders(res);
-      res.setHeader("Content-Type", "application/javascript; charset=utf-8");
-      res.setHeader("Content-Length", Buffer.byteLength(fixed, "utf-8"));
-      res.end(fixed, "utf-8");
-      return;
-    }
-
-    // Cache miss — compile
-    const source = await fs.readFile(filePath, "utf-8");
-    let compiled = await this.compiler.compileAsync(source, filePath);
-
-    const esbuild = await import("esbuild");
-    const tsResult = await esbuild.transform(compiled, {
-      loader: "ts",
-      format: "esm",
-      target: "esnext",
-      sourcefile: filePath,
-    });
-    compiled = tsResult.code;
-
-    // Fix compiler-emitted wrong paths before import rewriting
-    compiled = applyPathFixup(compiled);
-
-    // Inline import.meta.env references before import rewriting
-    compiled = inlineEnvReferences(compiled, this.context.env);
-
-    // Strip CSS static-asset imports — they are not ES modules
-    compiled = stripCssImports(compiled, url);
-
-    const bareImportPattern = /(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/;
-    if (bareImportPattern.test(compiled)) {
-      console.warn(`[.ui] Compiled output contains bare imports: ${url}`);
-    }
-
-    const rewritten = await rewriteImports(compiled, filePath, this.context.resolver);
-    const finalCode = applyPathFixup(rewritten);
-
-    await compilationCache.set(filePath, compiled, finalCode, (c) => this.getDependencies(c));
-
-    if (bareImportPattern.test(finalCode)) {
-      console.error(`[.ui] Bare imports still present after rewriting: ${url}`);
-      for (const m of Array.from(rewritten.matchAll(/(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/g)).slice(0, 3)) {
-        console.error(`[.ui] Unresolved import: ${m[1]}`);
-      }
-    }
-
-    setDevHeaders(res);
-    res.setHeader("Content-Type", "application/javascript; charset=utf-8");
-    res.setHeader("Content-Length", Buffer.byteLength(finalCode, "utf-8"));
-    res.end(finalCode, "utf-8");
-  }
-}
-
-function stripCssImports(code: string, url: string): string {
-  // Single well-ordered pass: static imports first, then dynamic imports
-  const before = code;
-  code = code.replace(/^[^\S\r\n]*import\s[^'"]*['"][^'"]*\.css['"]\s*;?[^\S\r\n]*$/gm, "");
-  code = code.replace(/\bimport\s*\(\s*['"][^'"]*\.css['"]\s*\)/g, "undefined");
-  if (before !== code) {
-    console.log(chalk.blue(`[.ui] Stripped CSS imports from ${url}`));
+    await this.compileAndServe(url, filePath, res, ".ui");
   }
-  return code;
 }

package/src/dev-engine/handlers/uix-handler.ts

@@ -5,22 +5,10 @@
  */
 
 import type { Response } from "express";
-import { promises as fs } from "node:fs";
-import { UiCompiler } from "@swissjs/compiler";
 import chalk from "chalk";
-import { rewriteImports } from "../../resolution/rewriting/import-rewriter.js";
-import { inlineEnvReferences } from "../../config/env.js";
-import { compilationCache } from "../../internal/cache/compilation-cache.js";
-import { fixSwissLibPaths } from "../../resolution/path/path-fixup.js";
-import {
-  BaseHandler,
-  setDevHeaders,
-  type HandlerContext,
-} from "./base-handler.js";
+import { BaseHandler, type HandlerContext } from "./base-handler.js";
 
 export class UIXHandler extends BaseHandler {
-  private compiler = new UiCompiler();
-
   constructor(context: HandlerContext) {
     super(context);
   }
@@ -28,68 +16,6 @@ export class UIXHandler extends BaseHandler {
   async handle(url: string, res: Response): Promise<void> {
     const filePath = await this.resolveFilePath(url);
     console.log(chalk.blue(`[.uix] ${url}`));
-
-    const pathFixupEnabled = this.context.userConfig?.compilerPathFixup?.enabled !== false;
-    const pathFixupPatterns = this.context.userConfig?.compilerPathFixup?.patterns;
-    const applyPathFixup = (code: string) =>
-      pathFixupEnabled ? fixSwissLibPaths(code, pathFixupPatterns) : code;
-
-    // Cache hit
-    const cached = await compilationCache.get(filePath, (compiled) => this.getDependencies(compiled));
-    if (cached) {
-      const fixed = applyPathFixup(cached);
-      setDevHeaders(res);
-      res.setHeader("Content-Type", "application/javascript; charset=utf-8");
-      res.send(fixed);
-      return;
-    }
-
-    // Cache miss — compile
-    const source = await fs.readFile(filePath, "utf-8");
-    let compiled = await this.compiler.compileAsync(source, filePath);
-
-    const esbuild = await import("esbuild");
-    const tsResult = await esbuild.transform(compiled, {
-      loader: "ts",
-      format: "esm",
-      target: "esnext",
-      sourcefile: filePath,
-    });
-    compiled = tsResult.code;
-
-    // Fix compiler-emitted wrong paths before import rewriting
-    compiled = applyPathFixup(compiled);
-
-    // Inline import.meta.env references before import rewriting
-    compiled = inlineEnvReferences(compiled, this.context.env);
-
-    // Strip CSS static-asset imports — they are not ES modules
-    const beforeCss = compiled;
-    compiled = compiled.replace(/^[^\S\r\n]*import\s[^'"]*['"][^'"]*\.css['"]\s*;?[^\S\r\n]*$/gm, "");
-    compiled = compiled.replace(/\bimport\s*\(\s*['"][^'"]*\.css['"]\s*\)/g, "undefined");
-    if (beforeCss !== compiled) {
-      console.log(chalk.blue(`[.uix] Stripped CSS imports from ${url}`));
-    }
-
-    const bareImportPattern = /(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/;
-    if (bareImportPattern.test(compiled)) {
-      console.warn(`[.uix] Compiled output contains bare imports: ${url}`);
-    }
-
-    const rewritten = await rewriteImports(compiled, filePath, this.context.resolver);
-    const finalCode = applyPathFixup(rewritten);
-
-    await compilationCache.set(filePath, compiled, finalCode, (c) => this.getDependencies(c));
-
-    if (bareImportPattern.test(finalCode)) {
-      console.error(`[.uix] Bare imports still present after rewriting: ${url}`);
-      for (const m of Array.from(rewritten.matchAll(/(?:import|from|export).*['"](@[^'"]+\/[^'"]+)(?!\/)[^'"]*['"]/g)).slice(0, 3)) {
-        console.error(`[.uix] Unresolved import: ${m[1]}`);
-      }
-    }
-
-    setDevHeaders(res);
-    res.setHeader("Content-Type", "application/javascript; charset=utf-8");
-    res.send(finalCode);
+    await this.compileAndServe(url, filePath, res, ".uix");
   }
 }

package/src/dev-engine/hmr/hmr.ts

@@ -13,16 +13,42 @@ export class HMREngine {
   private watcher?: chokidar.FSWatcher;
   private clients = new Set<WebSocket>();
   private port: number;
+  /** Origins permitted to connect (e.g. "http://localhost:3000"). */
+  private allowedOrigins: Set<string>;
 
   constructor(
     private root: string,
     hmrPort?: number,
+    allowedOrigins: string[] = [],
   ) {
     this.port = hmrPort || 24678;
+    // Security (R-002): build an origin allowlist.
+    // Always allow the two canonical loopback forms so a default dev setup
+    // (host: "localhost", port: 3000) works without any extra config.
+    this.allowedOrigins = new Set([
+      ...allowedOrigins,
+    ]);
     // WebSocketServer will be created in initialize() method
     // This allows async port checking before server creation
   }
 
+  /**
+   * Return true when `origin` is on the allowlist.
+   * - Absent / empty origin header → REJECT (not a browser page request).
+   * - Exact match (scheme + host + optional port) → ALLOW.
+   * - The check is case-insensitive on the scheme+host portion per RFC 6454.
+   */
+  private isOriginAllowed(origin: string | undefined): boolean {
+    if (!origin) return false;
+    // Normalise: strip trailing slash, lower-case scheme+host.
+    const normalise = (o: string) => o.replace(/\/$/, "").toLowerCase();
+    const candidate = normalise(origin);
+    for (const allowed of this.allowedOrigins) {
+      if (normalise(allowed) === candidate) return true;
+    }
+    return false;
+  }
+
   async initialize(): Promise<void> {
     // Check if port is available, if not find a free one
     const isAvailable = await this.checkPortAvailable(this.port);
@@ -51,7 +77,26 @@ export class HMREngine {
   }
 
   private setupWebSocket() {
-    this.wss.on("connection", (ws) => {
+    // Security (R-002): validate the Origin header on every incoming WebSocket
+    // upgrade to prevent cross-site WebSocket hijacking.  A malicious page
+    // served from a different origin cannot subscribe to HMR events (which
+    // include absolute filesystem paths of every changed file).
+    //
+    // Connections with a missing or non-allowlisted Origin are rejected with
+    // a 403 close frame.  Same-origin connections from the dev server's own
+    // host:port are always allowed via this.allowedOrigins.
+    this.wss.on("connection", (ws, req) => {
+      const origin = req.headers["origin"];
+      if (!this.isOriginAllowed(origin)) {
+        console.warn(
+          chalk.red(
+            `[HMR] Rejected connection from disallowed origin: ${origin ?? "(none)"}`,
+          ),
+        );
+        ws.close(1008, "Origin not allowed");
+        return;
+      }
+
       this.clients.add(ws);
       console.log(chalk.green("[HMR] Client connected"));